arkei | ec0e3f40d7c60b705623b9d743de671aeab07ffbca5ee7c4646d6e30fe8d7546 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 01:45

Sharing

Report Analysis Logs

General

Target

ca29ff3eb553c5995a5cbb358e18fd20.exe
Size

107KB
MD5

ca29ff3eb553c5995a5cbb358e18fd20
SHA1

7a3f4cf9875cb230aea1575f117ed8c77000e511
SHA256

ec0e3f40d7c60b705623b9d743de671aeab07ffbca5ee7c4646d6e30fe8d7546
SHA512

e81a3c70a17ac7610df5ea056a56fb3e65fe51721dee8f2a962d840fc50ea4eca815b11fc5d07d2246cf32d555340ac1156131c7cb3e346f7e1866cacc53b5a0
SSDEEP

3072:U96xNOZ+EYq8klcPMxtoSzEphwPgKWE6HAj:U9uOdBjoSzEpYzEu

Score

10^/10

arkei stealer

Malware Config

Extracted

Family

arkei

C2

95.181.157.6/G7yb65MmI9.php

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Suspicious use of SetThreadContext 1 IoCs

Processes:

ca29ff3eb553c5995a5cbb358e18fd20.exe

description pid process target process

PID 320 set thread context of 4904 320 ca29ff3eb553c5995a5cbb358e18fd20.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4224 320 WerFault.exe ca29ff3eb553c5995a5cbb358e18fd20.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ca29ff3eb553c5995a5cbb358e18fd20.exe

description	pid	process	target process
PID 320 wrote to memory of 4904	320	ca29ff3eb553c5995a5cbb358e18fd20.exe	RegSvcs.exe
PID 320 wrote to memory of 4904	320	ca29ff3eb553c5995a5cbb358e18fd20.exe	RegSvcs.exe
PID 320 wrote to memory of 4904	320	ca29ff3eb553c5995a5cbb358e18fd20.exe	RegSvcs.exe
PID 320 wrote to memory of 4904	320	ca29ff3eb553c5995a5cbb358e18fd20.exe	RegSvcs.exe
PID 320 wrote to memory of 4904	320	ca29ff3eb553c5995a5cbb358e18fd20.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\ca29ff3eb553c5995a5cbb358e18fd20.exe
"C:\Users\Admin\AppData\Local\Temp\ca29ff3eb553c5995a5cbb358e18fd20.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 272
2⤵
- Program crash
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 320 -ip 320
1⤵
PID:3500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-0-0x0000000000740000-0x000000000075F000-memory.dmp

Filesize
124KB

Download
memory/4904-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4904-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download